package dataserver.controller.config;

import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.Enumeration;

/**
 * @author lrz
 */
public class InterceptorAll implements HandlerInterceptor {

	/**
	 * 在请求处理之前进行调用（Controller方法调用之前）
	 */
	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object object) throws Exception {
		//防注入
		 Enumeration<String> names = request.getParameterNames();
		 while (names.hasMoreElements()) {
			 String name = names.nextElement();
			 String[] values = request.getParameterValues(name);
			 for (String value : values) {
				 value = clearXss(value);
			 }
		 }
		return true;
	}

	/**
	 * 请求处理之后进行调用，但是在视图被渲染之前（Controller方法调用之后）
	 */
	@Override
	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object object, ModelAndView mv)
			throws Exception {
		// TODO Auto-generated method stub

	}

	/**
	 * 在整个请求结束之后被调用，也就是在DispatcherServlet 渲染了对应的视图之后执行 （主要是用于进行资源清理工作）
	 */
	@Override
	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object object, Exception ex)
			throws Exception {
		// TODO Auto-generated method stub

	}
	
	 /** 
	  * 处理字符转义
	  * @param value
	  * @return */ 
	private String clearXss(String value) {
		if (value == null || "".equals(value)){ 
			return value; 
		} 
		value = value.replaceAll("<", "<").replaceAll(">", ">"); 
		value = value.replaceAll("\\(", "(").replace("\\)", ")"); 
		value = value.replaceAll("'", "'"); 
		value = value.replaceAll("eval\\((.*)\\)", ""); 
		value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
		value = value.replace("script", ""); 
		return value; 
		}



}
